<div dir="ltr">Hi -- I posted this question to serverfault -- I think maybe I should ping this list though as I'm not sure if this is a bug:<div> </div><div><a href="http://serverfault.com/questions/678884/realm-join-client-software-sssd-on-centos-7-joins-two-realms-one-with-sssd">http://serverfault.com/questions/678884/realm-join-client-software-sssd-on-centos-7-joins-two-realms-one-with-sssd</a> </div><div> </div><div>On clean installed centos-7 host:<pre style="margin-top:0px;padding:5px;border:0px;font-size:13px;overflow:auto;width:auto;max-height:600px;background-color:rgb(238,238,238);font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;word-wrap:normal"><code style="margin:0px;padding:0px;border:0px;font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;white-space:inherit">realm join -U foo --client-software sssd <a href="http://AD.EXAMPLE.COM">AD.EXAMPLE.COM</a> </code></pre>After running <code style="margin:0px;padding:1px 5px;border:0px;font-size:13px;font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;background-color:rgb(238,238,238);white-space:pre-wrap">realm list</code> output looks initially like this:<pre style="margin-top:0px;padding:5px;border:0px;font-size:13px;overflow:auto;width:auto;max-height:600px;background-color:rgb(238,238,238);font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;word-wrap:normal"><code style="margin:0px;padding:0px;border:0px;font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;white-space:inherit"><a href="http://AD.EXAMPLE.COM">AD.EXAMPLE.COM</a> type: kerberos realm-name: <a href="http://AD.EXAMPLE.COM">AD.EXAMPLE.COM</a> domain-name: <a href="http://ad.example.com">ad.example.com</a> configured: kerberos-member server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common login-formats: %<a href="mailto:U@ad.example.com">U@ad.example.com</a> login-policy: allow-realm-logins </code></pre>Showing me that I joined an active directory with sssd as I had intended -- logins work as expected both via ssh and samba.Later on (not sure what triggers or it but a system reboot guarantees it) -- the realm list output changes to this<pre style="margin-top:0px;padding:5px;border:0px;font-size:13px;overflow:auto;width:auto;max-height:600px;background-color:rgb(238,238,238);font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;word-wrap:normal"><code style="margin:0px;padding:0px;border:0px;font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;white-space:inherit"><a href="http://ad.example.com">ad.example.com</a> type: kerberos realm-name: <a href="http://AD.EXAMPLE.COM">AD.EXAMPLE.COM</a> domain-name: <a href="http://ad.example.com">ad.example.com</a> configured: kerberos-member server-software: active-directory client-software: winbind required-package: oddjob-mkhomedir required-package: oddjob required-package: samba-winbind-clients required-package: samba-winbind required-package: samba-common login-formats: AD\%U login-policy: allow-any-login <a href="http://AD.EXAMPLE.COM">AD.EXAMPLE.COM</a> type: kerberos realm-name: <a href="http://AD.EXAMPLE.COM">AD.EXAMPLE.COM</a> domain-name: <a href="http://ad.example.com">ad.example.com</a> configured: kerberos-member server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common login-formats: %<a href="mailto:U@ad.example.com">U@ad.example.com</a> login-policy: allow-realm-logins </code></pre></div><div>A few more details: -- after running realm join --verbose --client-software sssd --user foo <a href="http://AD.EXAMPLE.COM">AD.EXAMPLE.COM</a>, I </div><div> </div><div>(1) shutdown sssd</div><div>(2) replace sssd.conf</div><div>(3) rm -rf /var/lib/sss/db/*</div><div>(4) restart sssd</div><div> </div><div>I have to do this because the active directory domain I'm joining is larger than the default ldap_idmap_range_size -- the sssd.conf I generate looks like this:</div><div> </div><div>[sssd] domains = <a href="http://AD.UCSD.EDU">AD.UCSD.EDU</a> config_file_version = 2 services = nss, pam [domain/<a href="http://AD.UCSD.EDU">AD.UCSD.EDU</a>] ad_domain = <a href="http://AD.UCSD.EDU">AD.UCSD.EDU</a> krb5_realm = <a href="http://AD.UCSD.EDU">AD.UCSD.EDU</a> realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = True fallback_homedir = /home/%d/%u ldap_idmap_default_domain=<a href="http://AD.UCSD.EDU">AD.UCSD.EDU</a> ldap_idmap_range_size=2000000 ldap_search_base = dc=AD,dc=UCSD,dc=EDU override_homedir=/home/%d/%u dyndns_update=False access_provider = ad # define the sts_ad_access_filter host variable in ansible if you wish to restrict access to this host # example: sts_ad_access_filter: "(memberOf=CN=somts,OU=Share-access,OU=BusinessOffice,OU=Groups,OU=SOMTS,OU=SIO,DC=AD,DC=UCSD,DC=EDU)"</div><div> </div><div> </div><div>I also try with a realmd.conf </div><div> </div><div>[active-directory] default-client = sssd [service] automatic-install = no</div><div> </div><div>No matter what I do:</div><div> </div><div>- realm list initially doesn't return anything about a winbind domain -- but everything works</div><div>- after reboot, realm list shows the two domains (and now I can login as either <a href="mailto:user@ad.example.com">user@ad.example.com</a> or AD\\user ...</div><div> </div><div>Maybe this is by design -- but I suspect that something is afoot and this has me worried ... I've been re-doing clean installs trying to figure this out for hours now -- here's a snippet from my ansible config automated this if it helps anyone reproduce ...</div><div> </div><div><pre style="background-color:rgb(12,16,33);color:rgb(248,248,248);font-family:Menlo;font-size:12pt">--- - name: "Ensure libraries required to join Active Directory domain are installed" yum: name={{ item }} state="present" with_items: - krb5-workstation - realmd - sssd - samba - oddjob - oddjob-mkhomedir - adcli - samba-common - name: "Ensure winbind is not present to avoid the possibility of CRAZY CONFUSION?" yum: name={{ item }} state="absent" with_items: - samba-winbind - samba-winbind-clients - samba-winbind-krb5-locator - samba-winbind-modules - name: "Ensure sane realmd.conf exists prior to running realm command" template: src=sssd/realmd.conf.j2 dest=/etc/realmd.conf - name: "Test if we are currently part of Active Directory" shell: "realm list" register: domain_membership_test ignore_errors: True - name: "Join to UCSD Active directory if needed" when: domain_membership_test.stdout.find("<a href="http://AD.EXAMPLE.COM">AD.EXAMPLE.COM</a>") == -1 shell: "echo -n {{ foo_password_from_vault }} | realm join --user foo --verbose --client-software sssd --server-software active-directory <a href="http://AD.EXAMPLE.COM">AD.EXAMPLE.COM</a>" notify: - clear sssd cache and restart #- name: "Ensure appropriate krb5.conf file is deployed" # template: src=sssd/krb5.conf.j2 dest=/etc/krb5.conf # a custom sssd.conf is needed rather than the one built by realm for a few reasons: # - default ldap_idmap_range_size is too small for ucsd-ad # - want custom ad_access_filter # - want deterministic id mapping for @<a href="http://AD.EXAMPLE.COM">AD.EXAMPLE.COM</a> domain which requires: # using a pre-established ldap_idmap_range_size and using ldap_idmap_default_domain which ensures that @<a href="http://ad.ucsd.edu">ad.ucsd.edu</a> will always be mapped into first domain 'slice' - name: "Ensure appropriate sssd.conf is deployed" template: src=sssd/sssd.conf.j2 dest=/etc/sssd/sssd.conf mode=0600 notify: - clear sssd cache and restart - name: "Ensure sssd service is enabled" service: name=sssd enabled=yes </pre></div></div>